MAD Bugs: Even "cat readme.txt" is not safe
In a previous post about AI-discovered bugs in Vim and Emacs, we looked at how seemingly harmless workflows could cross a surprising line into code execution. This time we wanted to push that idea even further: is cat readme.txt safe?It turns out that it is NOT, if you use iTerm2.That looks insane until you understand what iTerm2 is trying to do for a legitimate feature, how it uses the PTY, and what happens when terminal output is able to impersonate one side of that feature's protocol.We'd lik...
Read more at blog.calif.io